To evaluate the roledn part of the ACI, the server
reads the value of the ou attribute stored in the targeted
entry. The server then substitutes this value in the subject to expand the
macro. In the example, the roledn is expanded as follows: